Ubuntu 14.04 LTS: USN-2855-1 Critical: Samba DoS Threats

ubuntu

January 5, 2016

Several security issues were fixed in Samba.

Summary

Several security issues were fixed in Samba.

Software Description:

- samba: SMB/CIFS file, print, and login server for Unix

Details:

Thilo Uttendorfer discovered that the Samba LDAP server incorrectly handled

certain packets. A remote attacker could use this issue to cause the LDAP

server to stop responding, resulting in a denial of service. This issue

only affected Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10.

(CVE-2015-3223)

Jan Kasprzak discovered that Samba incorrectly handled certain symlinks. A

remote attacker could use this issue to access files outside the exported

share path. (CVE-2015-5252)

Stefan Metzmacher discovered that Samba did not enforce signing when

creating encrypted connections. If a remote attacker were able to perform a

man-in-the-middle attack, this flaw could be exploited to view sensitive

information. (CVE-2015-5296)

It was discovered that Samba incorrectly performed access control when

using the VFS shadow_copy2 module. A ...

Read the Full Advisory

Topics Covered

security advisory denial of service security issue update critical samba ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  samba                           2:4.1.17+dfsg-4ubuntu3.1

Ubuntu 15.04:
  samba                           2:4.1.13+dfsg-4ubuntu3.1

Ubuntu 14.04 LTS:
  samba                           2:4.1.6+dfsg-1ubuntu2.14.04.11

Ubuntu 12.04 LTS:
  samba                           2:3.6.3-2ubuntu2.13

In general, a standard system update will make all the necessary changes.